Absence Makes the Heart Grow Fonder: New Directions for Implantable - PowerPoint PPT Presentation

Absence Makes the Heart Grow Fonder: New Directions for Implantable Medical Device Security Balancing Safety and Security Tamara Denning 1 , Tadayoshi Kohno 1 , Kevin Fu 2 1 University of Washington 2 University of Massachusetts at Amherst http://www.secure-medicine.org

Implantable Medical Devices (IMDs)  Pacemakers, Implantable Cardioverter Defibrillators (ICDs), Drug Pumps, Neurostimulators  Life-Supporting/Quality of Life  Devices Have Wireless Capabilities Tamara Denning, University of Washington, 2 7/29/2008 HotSec 2008

Wireless ICD Attacks  Obtain serial number, patient name, diagnosis  Turn off therapies  Induce cardiac fibrillation Pacemakers and implantable cardiac defibrillators: Software radio attacks and zero-power defenses [Halperin ], Oakland „08 Tamara Denning, University of Washington, 3 7/29/2008 HotSec 2008

Why Security? Malicious Attacks Tamara Denning, University of Washington, 4 7/29/2008 HotSec 2008

Malicious Computer-Based Attacks Tamara Denning, University of Washington, 5 7/29/2008 HotSec 2008

Current Security  IMD does not keep list of authorized programmers CLOSED ACCESS OPEN ACCESS  How about keeping a list and only allowing authorized programmers? Tamara Denning, University of Washington, 6 7/29/2008 HotSec 2008

Goals of IMD Security Y N Y Tamara Denning, University of Washington, 7 7/29/2008 HotSec 2008

Tensions of IMD Security  Safety in the Common Case  Timely access anywhere, anytime  Security in the Adversarial Case  Protect from unauthorized access CLOSED ACCESS OPEN ACCESS Tamara Denning, University of Washington, 8 7/29/2008 HotSec 2008

Insufficient Approaches  Case-by-Case Access Credentials  User Alert  Require Close Proximity CLOSED ACCESS OPEN ACCESS Tamara Denning, University of Washington, 9 7/29/2008 HotSec 2008

Insufficient Approaches  Case-by-Case Access Credentials  User Alert  Require Close Proximity CLOSED ACCESS OPEN ACCESS Tamara Denning, University of Washington, 10 7/29/2008 HotSec 2008

Insufficient Approaches  Case-by-Case Access Credentials  User Alert  Require Close Proximity CLOSED ACCESS OPEN ACCESS Tamara Denning, University of Washington, 11 7/29/2008 HotSec 2008

What about encryption with a carried passkey? Y N Y Tamara Denning, University of Washington, 12 7/29/2008 HotSec 2008

What about encryption with a carried passkey? Y N Y N Tamara Denning, University of Washington, 13 7/29/2008 HotSec 2008

New Approach What if we REMOVE something to gain access? Communication Cloaker Tamara Denning, University of Washington, 14 7/29/2008 HotSec 2008

How it works Y N Y Tamara Denning, University of Washington, 15 7/29/2008 HotSec 2008

Communication Cloaker  Present  Allows Pre-Approved Programmers (common case)  Blocks Unauthorized Programmers (adversarial case)  Absent  Fails open…Allows All Programmers! CLOSED ACCESS OPEN ACCESS Tamara Denning, University of Washington, 16 7/29/2008 HotSec 2008

Assumptions  IMD Power is Limited – Use Cheap Cryptography  Cloaker Can be Recharged – Use Heavier Cryptography  IMD and Cloaker are Paired Long-term Tamara Denning, University of Washington, 17 7/29/2008 HotSec 2008

Challenges  How to handle IMD-Programmer communications?  How the IMD “knows” the Cloaker‟s presence?  What if the emergency staff can‟t locate the Cloaker? Tamara Denning, University of Washington, 18 7/29/2008 HotSec 2008

Challenges…Possible Answers  How to handle IMD-Programmer communications? ? Hand off symmetric key pair ? Proxy  How the IMD “knows” the Cloaker‟s presence? ? IMD listens and queries oracle ? Keep-alives  What if the emergency staff can‟t locate the Cloaker?  Pulse sensor Tamara Denning, University of Washington, 19 7/29/2008 HotSec 2008

Preliminary Simulation  14 Java classes ModuleType Code Size Cloaker 179  TCP sockets IMD 115 Programmer 44  Inputs alter system Other 294  Selective DoS, jamming all wireless Code Function Code Size  Manageable code size I/O 124 Configuration 72 Communication 436 Tamara Denning, University of Washington, 20 7/29/2008 HotSec 2008

Summary  New Approach to IMD Security  Further Investigations:  Passively-powered transceivers (WISPs)  Patient must wear Cloaker  Psychological Impact  What if the patient‟s wrist is trapped in a car? Tamara Denning, University of Washington, 21 7/29/2008 HotSec 2008

Interesting Research Landscape! Auditability Safety (open access) Psychological Effects High Impact Patient Usability Security (closed access) Storage Constraints IMD Response Time Battery Life Tamara Denning, University of Washington, 22 7/29/2008 HotSec 2008